A malformed Portable Executable file can trigger a subtraction that underflows to a large value, causing the kernel crypto helper to read beyond the bounds of allocated memory. This out‑of‑bounds read leads to a kernel panic, halting the operating system and resulting in a denial of service. The issue was addressed by validating the addition and ensuring the resulting length does not exceed the actual file size before performing the hash update.

All Linux kernel builds that contain the vulnerable code before the inclusion of the fix commit are affected. The CNA data does not provide specific vendor or version information, so affected distributions and kernel versions cannot be enumerated.

With a CVSS score of 5.5 this vulnerability is considered moderate in severity, and its EPSS score of < 1% together with its absence from CISA’s KEV catalog indicate a low likelihood of exploitation in the wild. An attacker can trigger the crash by supplying a crafted Portable Executable file that causes an unsigned subtraction to underflow and results in a large buffer length passed to crypto_shash_update(). If the kernel’s kexec or PE signature verification path is exercised with such a file, the kernel will attempt to read out of bounds, leading to a panic that halts the operating system and causes a denial of service. Although exploitation probability is low, the hard crash means that the risk remains significant once the vulnerability is known.